AI tools now write phishing emails that are grammatically flawless and sound genuinely professional, making the old 'look for spelling mistakes' advice obsolete. But scammers still leave detectable patterns—in the sender address, link destinations, urgency language, and what they are asking you to do. Checking these six signals takes under a minute and stops most attacks.
For years, the advice was simple: if an email has typos and awkward phrasing, it is probably a scam. That advice is now outdated. AI writing tools produce polished, natural-sounding text in seconds, and phishing emails today are often indistinguishable in tone and grammar from real company communications.
The good news: scammers still have to work around technical realities and human psychology that leave detectable patterns. These six signals don't require any special software — just a moment of attention.
Check the actual sending address, not the display name
Every email client shows a "from" name, which anyone can set to anything. "PayPal Security Team" can be displayed by anyone sending from scammer123@randomdomain.xyz.
Click or tap on the sender name to expand and see the full email address. Look at the domain — the part after the @ symbol. If an email claiming to be from your bank comes from a domain that is not your bank's real website address, it is fake. Watch for subtle substitutions like "paypa1.com" (the number 1 instead of the letter l) or added words like "paypal-support.com."
Hover over every link before you click
On a computer, rest your mouse cursor over any link in the email without clicking. The actual destination URL appears in the bottom-left corner of your browser or email client. On a phone, press and hold a link to see the destination URL before opening it.
Compare that URL to the company's real website address. If they don't match, don't click. Even if the link text says "amazon.com," the actual destination could be anywhere.
Spot urgency and fear language
AI makes scam emails grammatically perfect, but it cannot remove the fundamental mechanic that makes phishing work: panic. Scammers need you to act before you think.
Watch for phrases like "your account will be closed in 24 hours," "immediate action required," "unauthorized access detected," or "verify now to avoid suspension." Legitimate companies send these kinds of warnings too — but they give you days to respond, not hours, and they don't threaten permanent loss in the first sentence. When an email is trying to make you feel rushed, that is exactly when you should slow down.
Notice what information they are actually asking for
Real companies almost never ask you to confirm your full password, Social Security number, or payment card details by clicking a link in an email. They already have your account on file. When an email asks you to "confirm your information" by entering it again somewhere, that is the scam's core mechanic — harvesting your credentials.
Also watch for requests that seem slightly off for the company: a shipping notification asking you to pay a customs fee, a streaming service asking you to update billing by clicking a link, or an IT department asking for your login credentials "for maintenance."
Verify through the company's real channel directly
If an email claims there is a problem with your account, don't use any link, phone number, or attachment in that email. Instead:
Open a new browser tab and type the company's address directly — or use a bookmark you created yourself. Log in there and check whether the same alert appears in your account. Call customer service using the number on the company's official website or on the back of your card, not a number from the email. This one step stops virtually all phishing attacks cold.
Use your email provider's built-in reporting tools
Every major email service — Gmail, Outlook, Apple Mail — has a "report phishing" or "mark as spam" option. Use it. These reports help train filters that protect everyone else from the same campaign.
You can also forward suspicious emails to reportphishing@apwg.org, a nonprofit that tracks phishing campaigns globally. If the email impersonates a specific company, that company's security team wants to know — search for "company name report phishing" to find their dedicated address.
What to Try Next
Phishing emails are often the first step in a larger attack. Fake customer service scams explains what happens after you click — how scammers impersonate real brand support teams and collect your credentials — and how to find a company's real contact information. For a look at how AI-generated voice fits into these attacks, AI voice cloning scams explains what the technology sounds like and how to stay ahead of it.
